Getting Data In

fschange and legacy system logs app

tkwaller
Builder

Have an app that monitors system logs. Specifically files in the /etc/ path using fschange.
I know that fschange is "deprecated" but is currently working. I would like to update this app to current standards as it is a legacy app.
the stanza for this is:

[fschange:/etc/]
fullEvent=true
pollPeriod=180
recurse=true
sendEventMaxSize=100000
filesPerDelay=5
delayInMills=100
index=_audit

what would be the best practice for this or should it be left?

the main issue I have with this is that its picking up a log in that path and throwing :

08-11-2016 16:38:06.066 +0000 WARN  LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 10734 - data_source="/etc/mcollective/facts.yaml", "myhost.com", data_sourcetype="yaml-10"

How should I adjust the input to fix the breaking issue?

Thanks for the thoughts.

0 Karma

jkat54
SplunkTrust
SplunkTrust

fschange tells you when permissions on a file, etc are changed. It's hard to replace it.

What you could do is write a script that checks the permissions and drops those into the _audit index, but then you'll never really know EXACTLY when the permissions change happened. If a file is edited, etc. you can see it was by checking the modified date, but even the modified date can be "hacked".

So I'd stick with fschange for now if you really need the permissions auditing. However, there are better tools for monitoring file system permissions and access to files, that's why splunk deprecated this feature.

As for adjusting your inputs, you need to add TRUNCATE = <positive_integer> to your props.conf

http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Propsconf

TRUNCATE = <non-negative integer>
* Change the default maximum line length (in bytes).
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often
  a sign of garbage data).
* Defaults to 10000 bytes.
0 Karma

wilsonite
Explorer

Looks like you will want to adjust the props.conf file rather than your input.

Try this thread here:
https://answers.splunk.com/answers/4162/size-limit-for-an-event.html

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...